In 2026 the queue of a security operations centre (SOC) is read, enriched, triaged and in places acted on by AI, while the adversaries it faces use AI to move faster. The question is therefore no longer whether AI will enter the SOC. It is what the team becomes now that it has. This book answers that question for the whole blue team, the people and functions that defend an organisation, and it divides their work into five functions that every later chapter uses by name: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. This chapter states the question, the book's working thesis and the evidence that would show it wrong, and it introduces the two organisations and the reading paths. It concerns all five functions.
The three scenes below are illustrative composites set on one night in the autumn of 2026. They are not records of real events, and they do not use the identifiers of the cases that later chapters follow. They show three situations that the book treats as ordinary: a closure nobody reads, a proposal that a person must answer in seconds, and a feature that arrived without a decision.
The three scenes share a feature that is easy to overlook. In none of them did anyone choose a degree of delegation. The provider's closure, the shift lead's speed and the console's summary all came from defaults. The rest of the book argues that a blue team should choose, record and review such degrees, function by function.
Primary topics explored
- A night in two security operations centres
- The blue team in 2026
- The question the series had not asked of a team
- The working thesis
- Five functions and five degrees
- Why Europe, and why now
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 1: Introduction: The Blue Team Transformed in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Blue Team in Question” and is one of 32 drawn from the manuscript.